Bills Digest no. 121 2006–07

WARNING:
This Digest was prepared for debate. It reflects the legislation as
introduced and does not canvass subsequent amendments. This Digest
does not have any official legal status. Other sources should be
consulted to determine the subsequent official status of the
Bill.

The main purpose is to amend the Migration
Act 1958 ( the Migration Act ) and certain related legislation
to broaden the circumstances in which certain personal information
may be lawfully accessed or disclosed.

Background

In early 2004, the Parliament passed the
Migration Legislation Amendment (Identification and
Authentication) Act 2004. The operative provisions of that Act
amended the Migration Act and came into force in August 2004. They
strengthened the powers of government officials to collect personal
identifiers (signatures, photographs, height and weight
measurements, fingerprints, iris scans, audio or video recordings
etc) under the Migration Act in respect of non-citizens in certain
situations. These situations might include routine circumstances
such as when a person is applying for an Australian visa or going
through immigration clearance or circumstances when the person is
suspected of being an unlawful non-citizen. The amended Migration
Act contained various restrictions on accessing and disclosing such
personal identifiers except where expressly permitted.
Contravention of these restrictions constituted criminal offences
carrying significant penalties, including up to two years
imprisonment.

Similar powers for the collection of personal
identifiers from suspected illegal foreign fishers were introduced
into the Fisheries Management Act 1991 and the Torres
StraitFisheries Act 1984 in 2005(1) and
came into force in the Environment Protection and Biodiversity
Conservation Act 1999 in February 2007.(2)
Restrictions and penalties relating to unlawful access and
disclosure, consistent with those in the Migration Act, are also
contained in these Acts.

In the second reading speech for the Migration
Legislation Amendment (Information and Other Measures) Bill 2007,
the Minister stated:(3)

Since the provisions were inserted, it has become
clear that there have been some unintended consequences of the
access and disclosure provisions which need to be rectified.

The provisions impose criminal penalties in
relation to the access and disclosure of personal information,
unless that access or disclosure is expressly permitted. It has
become apparent that the list of permitted disclosures and access
grounds is too limited. My department s ability to continue normal
working practices is being seriously hampered and in some instances
activities have been discontinued as a result. For example, my
department can no longer disclose photos and signatures to
investigate and prosecute some Migration Act offences. My
department can also no longer disclose photos and signatures to law
enforcement agencies or the Commonwealth Director of Public
Prosecutions for the prosecution of crimes that are not immigration
related.

An independent review of these provisions is
scheduled to commence on the third anniversary of the provisions in
the second half of this year. It is expected that this review will
address many of the difficulties which have been identified with
the personal identifier provisions. However, in light of the
serious problems presently being faced by my department, it is
essential that certain amendments be made as soon as possible.
These are expected to resolve the most urgent problems being
experienced.

It appears this is the first time that the
problems referred to by the Minister above have been publicly
disclosed by the Government. As mentioned earlier in this Digest,
the problematic provisions in the Migration Act have been in force
since August 2004. However, it is understood that unintended
consequences only came to light in late 2005.(4) Given
the Minister has stated these consequences have been quite serious,
it is unclear why it took over 12 months for them to become
apparent. No information is available on whether any unlawful
disclosures might have inadvertently been made during the August
2004-late 2005 period, although the answer is presumably no. It is
also somewhat curious that it took well over 12 months, from late
2005, to introduce remedial legislation. This is particularly so
when the last package of access and disclosure amendments (those
contained in the Environment and Heritage Legislation Amendment
Act (No.1) 2006) to which this Bill is directed was only
introduced in to Parliament in October 2006 and passed in December
2006. There may be a sound rationale for this, but neither the
second reading speech nor the Explanatory Memorandum address this
issue.

Part 1 contains some 61 items. Items
1-59 make four sets of essentially identical amendments to
four Acts: the Migration Act 1958, the Fisheries
Management Act 1991, the Torres StraitFisheries
Act 1984, and the Environment Protection and Biodiversity
Conservation Act 1999. For the sake of brevity, only the
amendments to the Migration Act 1958 (items
31-44) are described and analysed below.

Seven of the amendments (items 31-32,
37-39, 42 and 44) replaces the existing term non-citizen
with person . This change is to deal with the situation when a
person, from whom a personal identifier is taken when they were not
an Australian citizen, subsequently becomes an Australian citizen.
For example, item 37 makes the replacement in
subparagraph 336E(2)(a)(i). That subparagraph currently allows
disclosure of identifying information (which is essentially
personal identifiers or related information derived from them) for
the purpose of data-matching in order to identify, or authenticate
the identity of, a non-citizen. The Explanatory Memorandum comments
that:

This amendment ensures that no offence is
committed under section 336E if identifying information, collected
from a non-citizen, is disclosed after the person has become an
Australian citizen (and so no longer fits the description of
non-citizen ). There is a particular risk that this may occur where
there is a large-scale disclosure of identifying information for
the purposes of data-matching.

Item 33 amends the definition
of disclosure in section 336A by making two changes. The
effect is to narrow the range of circumstances where disclosure of
identifying information may be an offence.

The first change replaces the existing phrase
includes provide access to the personal identifier with includes
provide unauthorised access to the personal identifier . The
Explanatory Memorandum comments:

The amendment makes clear the intention that
providing an authorised access to a personal identifier (under
section 336D) is not a disclosure within the meaning in section
336E (which makes it an offence to disclose identifying information
where the disclosure is not a permitted disclosure).

However, it is arguable that the amendment
does not actually do this. If this was the intent, it would have
been better to substitute the phrase does not include authorised
access .

The second change provides that disclosure
only relates to the disclosure of personal identifiers that have
been provided under specified sections of the Act currently the
definition covers any personal identifier, however it was
provided.

The intent of item 34 is
similar to the second change in item 33 described
above. It amends the definition of identifying information in
section 336A such that it only relates to a personal identifier
provided under specified sections of the Act. Again the effect is
to narrow the range of circumstances where disclosure of
identifying information may be an offence.

Item 35 inserts new
subsection 336C(1A). This creates a new exception to what
would otherwise be an offence of unauthorised access to identifying
information. Under item 35, no offence will occur if a person who
accesses the information believes on reasonable grounds that the
access is necessary to prevent or lessen a serious and imminent
threat to the life or health of the person or of any other person.
It is up to the person who accessed the information to demonstrate
that they had that reasonable belief. As noted by the Explanatory
Memorandum, this exception mirrors that contained in Information
Privacy Principles 10.1(b) and 11.1(c) of the Privacy Act
1988.

Item 36 inserts new
section 336(1A). It is essentially the same amendment as
item 35, except that the offence to which the new exemption relates
is unauthorised disclosure of, rather than unauthorised access to,
identifying information.

Item 40 inserts new
paragraph 336E(2)(da). This creates a new circumstance in
which a disclosure of identifying information is a permitted (ie
lawful) disclosure - where the disclosure is to a Commonwealth,
State or Territory agency for the purpose of verifying the relevant
person is an Australian citizen or holds a visa of a particular
class.

Item 41 inserts new
paragraphs 336E(2)(ea) and (eb). This creates another two
new circumstances in which a disclosure of identifying information
is a permitted disclosure - where the disclosure is reasonably
necessary for the enforcement of the criminal law of a Commonwealth
or of a State or Territory (paragraph 336E(2)(ea))
or required by or under a law of the Commonwealth or of a State of
Territory (paragraph 336E(2)(eb)). The Explanatory
Memorandum states that new paragraph
336E(2)(eb):

is similar to a provision which permits disclosure
of personal information under the Privacy Act 1988.

The relevant provision in the Privacy Act
1988 is Information Privacy Principles 11.1(d):

(d) the disclosure is required or authorised by or
under law

However, the 1996 Privacy Commissioner s
publication, Plain
English Guidelines to Information Privacy Principles 8 11
specifically states that State law is not law for the purposes of
Information Privacy Principle 11.1(d), except where a
State/Territory has validly legislated to bind the
Commonwealth.(6) Thus, on the face of it, the assertion
in Explanatory Memorandum quoted above is somewhat imprecise. The
Explanatory Memorandum does note that new paragraph 336E(2)
(eb):

uses the higher standard of required rather than
the Privacy Act standard of required or authorised due to the
nature of the information that may be disclosed under section 336E.
It is also consistent with existing paragraph 336D(2)(h) of the
Act, which allows access of identifying information to be
authorised for the purpose of complying with the laws of the
Commonwealth or the States or Territories.

Item 43 repeals existing
paragraph 336E(2)(g), substituting new paragraphs
336E(2)(g) and (ga). Existing paragraph 336E(2)(g) states
that disclosure of identifying information is a permitted
disclosure where it is for the purpose of an investigation by the
Privacy Commissioner or the Ombudsman into the carrying out of an
identification test or the requiring of the provision of a personal
identifier. The amendments broaden permitted disclosure to include
for the purposes of investigations of the Privacy Commissioner or
Ombudsman relating to any action taken by the administering
department(7) (paragraph 336E(2)(g)) or
of facilitating or expediting the exercise of powers, or
performance of functions, of the Migration Agents Registration
Authority ( the MARA ) (paragraph 336E(2)(ga). In
relation to the later, the Explanatory Memorandum comments:

[this will allow] for the disclosure of material,
which contains identifying information, to the MARA. For example,
where the MARA is investigating the conduct of a migration agent,
it had been DIAC s normal practice to provide to the MARA files
relating to the clients of the agent, to assist the MARA in its
investigations. Those files will often contain signatures and
photographs of the clients, collected, for example, for the
purposes of visa applications for which the agent was representing
the clients. The disclosure of those photos and signatures is an
offence under current section 336E. This amendment will ensure such
disclosures are not an offence.

Division 1 makes amendments
to the Migration Act 1958 that commence if the
Australian Citizenship (Transitionals and Consequentials)
Act2007 has not yet commenced. The Australian
Citizenship (Transitionals and Consequentials) Act2007 passed through both Houses on 26 February and
received Royal Assent on 15 March. The Bills Digest 73 (2005-06)
dated 6 December 2005 can be accessed here.

The Australian Citizenship (Transitionals
and Consequentials) Act2007 repeals the
Australian Citizenship Act 1948 at the time when the new
Australian Citizenship Act2007 commences.

Depending on when the new Citizenship Acts
commence, either item 62 or item
69 will apply. Item 64 also makes
transitional arrangements for authorisations made under section
336D of the Act to reflect the amended paragraph (g).

Currently, paragraph (g) provides that a
specified purpose is making decisions under this Act or the
regulations, or under the Australian Citizenship Act 1948
or the regulations made under that Act .

Item 62 substitutes
new paragraph 336D(2)(g) to permit authorisation
of access to identifying information for the purposes of the
Migration Act or regulations or for the purposes of the
Australian Citizenship Act 1948 or regulations made under
that Act.

The Explanatory Memorandum states that:

[T]he new, wider ground will ensure identifying
information can be accessed for the purposes of exercising powers
or performing functions under the legislation, including where the
power or function is not strictly concerned with making a decision
under the legislation.

The Secretary must not authorise access under
section 336D that is for the purpose of investigating an offence
against a law of the Commonwealth or a State or Territory; or
prosecuting a person for such an offence if the identifying
information in question relates to a personal identifier of a
prescribed type.

The Bills
Digest for the Migration Legislation Amendment (Identification
and Authentication) Bill 2003 noted in relation to section 336D
that:

The international obligations mentioned above are
implemented in domestic law through the Privacy Act
1988. The protection of personal information is set out
in the Information
Privacy Principles (IPPs).(46) Section 16 of
the Privacy Act states that an agency, defined to include
Commonwealth Departments, shall not collect, use and disclose
personal information inconsistently with the
IPPs.(47)

IPP 1 states that personal information should only
be collected if it is necessary for a lawful purpose directly
related to a function or activity of the collector. As noted
above, the purposes for collection of identifying material are very
generic. For example, the purposes in the Bill for the
collection of identifying material is stated to be mere
identification both in the present and future.(48)
Without further elaboration of the circumstances in which
identification is required, this would allow information to be
collected in cases where there was rarely if ever immigration
fraud. It gives rise to the question whether the
creation of a just-in-case database is a proportionate response to
the scale of identity fraud by non-citizens.

Moreover, the low level of generality of the
purposes for the Bill facilitating sharing of information with
agencies outside the immigration context, for example, domestic or
foreign enforcement agencies. While the Bill prohibits
disclosures of certain types of identifiers for the purposes of
investigating an offence against an Australian law,(49)
the prohibition is not absolute and no such limitation is imposed
on sharing of information in relation to foreign offences.
Indeed, the Bill itself contemplates the provision of data to
foreign law enforcement agencies.(50) Yet there is
no guarantee that the use of the identifying information by the law
enforcement agency will have any connection with the purpose for
which the data was collected in the first instance by the
Department of Immigration and Multicultural and Indigenous
Affairs.

In addition, it is unclear whether information
sharing arrangements with foreign countries would be subject to a
consideration of the consequences of that disclosure, for example,
whether they would lead to prosecutions under laws that do not have
any equivalent in Australian law.(8)

The Digest also points to the guidelines of
the Senate Regulations and Ordinances Committee for delegated
legislation, which suggest that regulations:

must not lessen the operation of provisions protecting human
rights

must show sensitivity to personal matters, and

must protect privacy.

Furthermore, the Administrative Review Council
in its report Rulemaking by Commonwealth Agencies,
recommends that measures which affect individual rights and
liberties, including powers of search, should be enacted in primary
legislation.(9)

Item 69 inserts new
paragraph 336E(2)(ha) to permit the disclosure of audio
and video recordings where the disclosure is for the purposes of
the Migration Act or regulations or for the purposes of the
Australian Citizenship Act 1948 or regulations made under
that Act. The disclosure must be for the purpose of transcribing or
translating the recording, or conducting language or accent
analysis of the recording.

The Explanatory Memorandum states that:

[t]his new permitted disclosure ground will allow
the Department to disclose tapes of interviews with detainees to
companies providing transcription and translation services, so that
the tape of interview can be transcribed and translated or both.
Currently, such a disclosure would constitute an offence under
section 336E.

If the Citizenship Acts do not commence, the
amendment is made by item 71. The application
provisions are contained in items 65 and 72. The
amendments do not apply to conduct taken before commencement.

Therefore, in summary, Part 2 of Schedule 2
sets out a complex commencement pattern to cover all contingencies
of the parent acts coming into operation. Items 62 and
63 will not commence if Schedule 1 to the Australian
Citizenship (Transitionals and Consequentials) Act 2007
commences before the main personal identifier amendments. The
equivalent provisions to items 62 and 63, should
the Act commence first, are items 68, 69 and 70,
and the application provision (equivalent to item
65) is item 72 of Schedule 1 to the
Bill.

Section 488 of the Act deals with tampering
with movements records. A movement record is defined in section 5
as information stored in a notified database, which is any database
so declared by the Minister in the Gazette under section
489.

Item 1 inserts new
paragraph 488(2)(aa) into the Migration Act which provides
that the Minister may authorise an officer, for the purpose of
making a movement record available to, and for the use of either
the person to whom the record relates or the duly appointed agent
of that person, to perform one or more of the actions listed in
subsection 488(1).

Existing subsection 488(1) makes it an offence
for a person to read, examine, reproduce by any means, or use or
disclose by any means, any part of a client s movement records,
otherwise than in accordance with an authority given under
subsection 488(2).

The authorisations in subsection 488(2) deal
with releasing records to relevant agencies but do not provide for
the disclosure of movement records to an individual to whom the
record relates or to his or her duly appointed agent.

The Explanatory Memorandum states:

This amendment will authorise the disclosure of
movement records to an individual to whom the record relates or to
his or her duly appointed agent. This will ensure consistency with
the objectives of the Freedom of Information Act 1982 and the
Ombudsman s view that government agencies should facilitate access
by an individual to his or her own information. The amendment will
also ensure the Department can respond to client requests in a more
efficient manner.(10)

Presumably the Explanatory Memorandum is
referencing the March 2006 Ombudsman report entitled
Scrutinising government: Administration of the Freedom of
Information Act 1982in Australian government
agencies which is available
here.

The new offences provide for custodial
penalties for foreign fishing offences in those parts of Australia
s territorial sea that are within the Australian Fishing Zone,
within the meaning of the FMA, or within any area of Australian
jurisdiction , within the meaning of the TSFA.

Items 1and
2 amend existing paragraphs 5(1)(a) and 5(1)(b) of the
Migration Act. These paragraphs list the various fishing offences
in the FMA and TSFA respectively that are deemed to fall within the
meaning of a fisheries detention offence in the Migration Act. This
allows non-citizens on foreign boats that are suspected of
involvement in fisheries offences to be granted visas that allow
the boats and persons to be taken back to Australia for the
purposes of investigating the suspected offence. Items 1 and 2
expand the range of fisheries offences falling within the meaning
of a fisheries detention offence to incorporate the offences
created by the Fisheries Legislation Amendment (Foreign Fishing
Offences) Act 2006 mentioned above.

Concluding comments

The reader s attention is drawn to comments
made towards the end of the background section of this Digest as to
the apparent delay in introducing legislation designed to address
the problematic access and disclosure restrictions regarding
personal identifiers in Migration Act 1958 and three other
related Acts.

This paper has been prepared to support the work of the
Australian Parliament using information available at the time of
production. The views expressed do not reflect an official position
of the Parliamentary Library, nor do they constitute professional
legal opinion.

Staff are available to discuss the paper's
contents with Senators and Members and their staff but not with
members of the public.

Except to the extent of the uses permitted under the
Copyright Act 1968, no part of this publication may be
reproduced or transmitted in any form or by any means, including
information storage and retrieval systems, without the prior
written consent of the Parliamentary Library, other than by members
of the Australian Parliament in the course of their official
duties.